added some authorization for user#edit and user#update